A.5.1 Policies for Information Security

What is this control?

ISO 27001 control A.5.1 Policies for Information Security requires organisations to establish a management-approved framework of information security policies that provides direction and support for information security. This control ensures that all policies are formally approved, published to a central repository, communicated to relevant personnel with acknowledgement captured, and reviewed at planned intervals. For Microsoft 365 environments, policy attestation is enforced through Microsoft Entra Terms of Use integrated with Conditional Access, requiring users to formally accept policies before accessing organisational resources.

How to implement in Microsoft 365

Implement A.5.1 by establishing a policy governance framework with clear ownership and approval processes. Publish all ISMS policies to a version-controlled SharePoint Online site as the single source of truth. Configure Microsoft Entra Terms of Use to require formal acceptance of key policies, then create Conditional Access policies that enforce Terms of Use acceptance as a grant control.

Enable audit logging to capture user acceptance with timestamp and device information. Configure re-acceptance frequency (recommend annually or upon policy update). Maintain a policy register in ISMSOnline or equivalent tracking ownership, version, approval date, and review schedule.

Review all policies annually or when significant changes occur to business operations, technology, or regulatory requirements.

What an auditor looks for

Auditors will verify that a formal policy governance framework exists with documented ownership for each policy. They will check that at least one Terms of Use policy is configured in Microsoft Entra ID and enforced via Conditional Access. They will review user attestation records to confirm at least 95% acceptance rate, identifying any users who have not accepted.

Auditors will examine the policy register to verify all policies have been reviewed within the last 12 months, have documented approvers, and show version history. They will also verify that CIS Benchmark assessments are configured in Microsoft Purview Compliance Manager for M365, Azure, and Intune configurations.

Related controls

• A.5.2
• A.6.2
• A.6.3
• A.6.6